The Linux kernel’s asymmetric key handling allows an unprivileged process to supply a PKCS#8 private key that lacks a key identifier to the key restriction interface. Because the parse routine does not populate an ID, the subsequent key_or_keyring_common function dereferences a NULL pointer, causing a general protection fault and kernel panic. The likely attack vector is the KEYCTL_RESTRICT_KEYRING interface, which an unprivileged user can invoke to supply a malicious PKCS#8 key. This vulnerability results in a denial‑of‑service because the system can abruptly crash without any escalation of privileges.

The flaw affects all Linux kernels that contain the asymmetric_keys implementation before the patch was applied. Any Linux distribution shipping a kernel version that does not yet include the mitigation commit (e.g., commit 1aa0c7aa4c2554a5b6d74ae1924508ca4718234b) is vulnerable. The vendor impact therefore covers the Linux kernel as a whole, including standard builds used by most distributions.

Based on the description, it is inferred that the attack requires local unprivileged access through the KEYCTL_RESTRICT_KEYRING interface. The exploitability is high because an attacker can trigger a kernel panic with minimal effort by submitting a malformed PKCS#8 key. No CVSS score is listed, but the kernel panic caused by this flaw constitutes a critical denial‑of‑service vector. The vulnerability is not listed in the CISA KEV catalog, and EPSS data is unavailable; however, the attack path is simple and does not rely on uncommon conditions.